@aooth/arbac 0.1.7 → 0.1.8

package/dist/index.cjs

@@ -290,6 +290,28 @@ function mergeScopeFilters(scopes) {
 	}
 	return { $or: scopes };
 }
+/**
+* Conjoin two ALREADY-UNIONED scope filters (each the output of
+* {@link mergeScopeFilters} for one authority pass) under `$and` semantics — a
+* row survives only if BOTH sides admit it. This is the credential-attenuation
+* combiner: it clips any widening the credential pass might introduce.
+*
+* Polarity is the **opposite** of {@link mergeScopeFilters}: an empty `{}` /
+* `undefined` filter is the universe and acts as the **identity** here
+* (dropped from the `$and`, contributing NO constraint) — never the absorbing
+* "unrestricted wins". Never object-spreads the two filters (credential keys
+* could overwrite user keys and silently widen).
+*
+* @returns the conjoined filter, or `undefined` when BOTH sides are unrestricted.
+*/
+function conjoinScopeFilters(a, b) {
+	const aEmpty = !a || Object.keys(a).length === 0;
+	const bEmpty = !b || Object.keys(b).length === 0;
+	if (aEmpty && bEmpty) return void 0;
+	if (aEmpty) return b;
+	if (bEmpty) return a;
+	return { $and: [a, b] };
+}
 function canOptimizeToIn(scopes) {
 	const firstKeys = Object.keys(scopes[0]);
 	if (firstKeys.length !== 1) return false;
@@ -380,6 +402,45 @@ function unionControlsPolicy(scopes) {
 	}
 	return result;
 }
+/**
+* Conjoin two ALREADY-UNIONED controls policies (each the output of
+* {@link unionControlsPolicy} for one authority pass) under DENY-WINS
+* intersection — a control is permitted only if BOTH passes permit it. This is
+* the credential-attenuation combiner; polarity is the **opposite** of
+* {@link unionControlsPolicy} (which is additive / silence-wins).
+*
+* Per control key (absent ≡ allowed, matching {@link unionControlsPolicy}):
+*   - denied (`false`) on EITHER side → `false`.
+*   - allowed on one side → the OTHER side's gate (`allow ∧ X = X`).
+*   - whitelist ∧ whitelist → the INTERSECTION of the two arrays (only values
+*     allowed by both; may be empty = nothing permitted).
+*
+* @returns merged policy; keys absent from the result mean "allowed" (callers
+*          treat a missing key as `true`), matching {@link unionControlsPolicy}.
+*/
+function intersectControlsPolicy(a, b) {
+	const result = {};
+	const keys = new Set([...Object.keys(a), ...Object.keys(b)]);
+	for (const key of keys) {
+		const av = key in a ? a[key] : true;
+		const bv = key in b ? b[key] : true;
+		if (av === false || bv === false) {
+			result[key] = false;
+			continue;
+		}
+		if (av === true) {
+			if (Array.isArray(bv)) result[key] = [...bv];
+			continue;
+		}
+		if (bv === true) {
+			if (Array.isArray(av)) result[key] = [...av];
+			continue;
+		}
+		const bset = new Set(bv);
+		result[key] = [...new Set(av)].filter((v) => bset.has(v)).toSorted();
+	}
+	return result;
+}
 //#endregion
 //#region src/codegen/extract.ts
 function hasWildcard(s) {
@@ -455,11 +516,13 @@ function generateResourceTypes(map, options) {
 exports.allowTableAction = allowTableAction;
 exports.allowTableRead = allowTableRead;
 exports.allowTableWrite = allowTableWrite;
+exports.conjoinScopeFilters = conjoinScopeFilters;
 exports.definePrivilege = definePrivilege;
 exports.defineRole = defineRole;
 exports.extractResourceActions = extractResourceActions;
 exports.generateResourceTypes = generateResourceTypes;
 exports.getProjectionMode = getProjectionMode;
+exports.intersectControlsPolicy = intersectControlsPolicy;
 exports.isFieldAllowed = isFieldAllowed;
 exports.mergeScopeFilters = mergeScopeFilters;
 exports.restrictProjection = restrictProjection;

package/dist/index.d.cts

@@ -206,6 +206,21 @@ declare function restrictProjection(desired: TProjection, accessControl: TProjec
  * @returns the merged filter, or `undefined` for unrestricted access
  */
 declare function mergeScopeFilters(scopes: TScopeFilter[]): TScopeFilter | undefined;
+/**
+ * Conjoin two ALREADY-UNIONED scope filters (each the output of
+ * {@link mergeScopeFilters} for one authority pass) under `$and` semantics — a
+ * row survives only if BOTH sides admit it. This is the credential-attenuation
+ * combiner: it clips any widening the credential pass might introduce.
+ *
+ * Polarity is the **opposite** of {@link mergeScopeFilters}: an empty `{}` /
+ * `undefined` filter is the universe and acts as the **identity** here
+ * (dropped from the `$and`, contributing NO constraint) — never the absorbing
+ * "unrestricted wins". Never object-spreads the two filters (credential keys
+ * could overwrite user keys and silently widen).
+ *
+ * @returns the conjoined filter, or `undefined` when BOTH sides are unrestricted.
+ */
+declare function conjoinScopeFilters(a: TScopeFilter | undefined, b: TScopeFilter | undefined): TScopeFilter | undefined;
 //#endregion
 //#region src/scope/controls.d.ts
 /**
@@ -243,6 +258,23 @@ declare function mergeScopeFilters(scopes: TScopeFilter[]): TScopeFilter | undef
 declare function unionControlsPolicy(scopes: ReadonlyArray<{
   controls?: Record<string, ControlGate>;
 }>): Record<string, ControlGate>;
+/**
+ * Conjoin two ALREADY-UNIONED controls policies (each the output of
+ * {@link unionControlsPolicy} for one authority pass) under DENY-WINS
+ * intersection — a control is permitted only if BOTH passes permit it. This is
+ * the credential-attenuation combiner; polarity is the **opposite** of
+ * {@link unionControlsPolicy} (which is additive / silence-wins).
+ *
+ * Per control key (absent ≡ allowed, matching {@link unionControlsPolicy}):
+ *   - denied (`false`) on EITHER side → `false`.
+ *   - allowed on one side → the OTHER side's gate (`allow ∧ X = X`).
+ *   - whitelist ∧ whitelist → the INTERSECTION of the two arrays (only values
+ *     allowed by both; may be empty = nothing permitted).
+ *
+ * @returns merged policy; keys absent from the result mean "allowed" (callers
+ *          treat a missing key as `true`), matching {@link unionControlsPolicy}.
+ */
+declare function intersectControlsPolicy(a: Record<string, ControlGate>, b: Record<string, ControlGate>): Record<string, ControlGate>;
 //#endregion
 //#region src/codegen/extract.d.ts
 interface TResourceActionMap {
@@ -279,4 +311,4 @@ interface TCodegenOptions {
  */
 declare function generateResourceTypes(map: TResourceActionMap, options?: TCodegenOptions): string;
 //#endregion
-export { type ControlGate, type RoleBuilder, type TCodegenOptions, type TPrivilegeFunction, type TProjection, type TProjectionMode, type TResourceActionMap, type TScopeFilter, allowTableAction, allowTableRead, allowTableWrite, definePrivilege, defineRole, extractResourceActions, generateResourceTypes, getProjectionMode, isFieldAllowed, mergeScopeFilters, restrictProjection, unionControlsPolicy, unionProjections };
+export { type ControlGate, type RoleBuilder, type TCodegenOptions, type TPrivilegeFunction, type TProjection, type TProjectionMode, type TResourceActionMap, type TScopeFilter, allowTableAction, allowTableRead, allowTableWrite, conjoinScopeFilters, definePrivilege, defineRole, extractResourceActions, generateResourceTypes, getProjectionMode, intersectControlsPolicy, isFieldAllowed, mergeScopeFilters, restrictProjection, unionControlsPolicy, unionProjections };

package/dist/index.d.mts

@@ -206,6 +206,21 @@ declare function restrictProjection(desired: TProjection, accessControl: TProjec
  * @returns the merged filter, or `undefined` for unrestricted access
  */
 declare function mergeScopeFilters(scopes: TScopeFilter[]): TScopeFilter | undefined;
+/**
+ * Conjoin two ALREADY-UNIONED scope filters (each the output of
+ * {@link mergeScopeFilters} for one authority pass) under `$and` semantics — a
+ * row survives only if BOTH sides admit it. This is the credential-attenuation
+ * combiner: it clips any widening the credential pass might introduce.
+ *
+ * Polarity is the **opposite** of {@link mergeScopeFilters}: an empty `{}` /
+ * `undefined` filter is the universe and acts as the **identity** here
+ * (dropped from the `$and`, contributing NO constraint) — never the absorbing
+ * "unrestricted wins". Never object-spreads the two filters (credential keys
+ * could overwrite user keys and silently widen).
+ *
+ * @returns the conjoined filter, or `undefined` when BOTH sides are unrestricted.
+ */
+declare function conjoinScopeFilters(a: TScopeFilter | undefined, b: TScopeFilter | undefined): TScopeFilter | undefined;
 //#endregion
 //#region src/scope/controls.d.ts
 /**
@@ -243,6 +258,23 @@ declare function mergeScopeFilters(scopes: TScopeFilter[]): TScopeFilter | undef
 declare function unionControlsPolicy(scopes: ReadonlyArray<{
   controls?: Record<string, ControlGate>;
 }>): Record<string, ControlGate>;
+/**
+ * Conjoin two ALREADY-UNIONED controls policies (each the output of
+ * {@link unionControlsPolicy} for one authority pass) under DENY-WINS
+ * intersection — a control is permitted only if BOTH passes permit it. This is
+ * the credential-attenuation combiner; polarity is the **opposite** of
+ * {@link unionControlsPolicy} (which is additive / silence-wins).
+ *
+ * Per control key (absent ≡ allowed, matching {@link unionControlsPolicy}):
+ *   - denied (`false`) on EITHER side → `false`.
+ *   - allowed on one side → the OTHER side's gate (`allow ∧ X = X`).
+ *   - whitelist ∧ whitelist → the INTERSECTION of the two arrays (only values
+ *     allowed by both; may be empty = nothing permitted).
+ *
+ * @returns merged policy; keys absent from the result mean "allowed" (callers
+ *          treat a missing key as `true`), matching {@link unionControlsPolicy}.
+ */
+declare function intersectControlsPolicy(a: Record<string, ControlGate>, b: Record<string, ControlGate>): Record<string, ControlGate>;
 //#endregion
 //#region src/codegen/extract.d.ts
 interface TResourceActionMap {
@@ -279,4 +311,4 @@ interface TCodegenOptions {
  */
 declare function generateResourceTypes(map: TResourceActionMap, options?: TCodegenOptions): string;
 //#endregion
-export { type ControlGate, type RoleBuilder, type TCodegenOptions, type TPrivilegeFunction, type TProjection, type TProjectionMode, type TResourceActionMap, type TScopeFilter, allowTableAction, allowTableRead, allowTableWrite, definePrivilege, defineRole, extractResourceActions, generateResourceTypes, getProjectionMode, isFieldAllowed, mergeScopeFilters, restrictProjection, unionControlsPolicy, unionProjections };
+export { type ControlGate, type RoleBuilder, type TCodegenOptions, type TPrivilegeFunction, type TProjection, type TProjectionMode, type TResourceActionMap, type TScopeFilter, allowTableAction, allowTableRead, allowTableWrite, conjoinScopeFilters, definePrivilege, defineRole, extractResourceActions, generateResourceTypes, getProjectionMode, intersectControlsPolicy, isFieldAllowed, mergeScopeFilters, restrictProjection, unionControlsPolicy, unionProjections };

package/dist/index.mjs

@@ -290,6 +290,28 @@ function mergeScopeFilters(scopes) {
 	}
 	return { $or: scopes };
 }
+/**
+* Conjoin two ALREADY-UNIONED scope filters (each the output of
+* {@link mergeScopeFilters} for one authority pass) under `$and` semantics — a
+* row survives only if BOTH sides admit it. This is the credential-attenuation
+* combiner: it clips any widening the credential pass might introduce.
+*
+* Polarity is the **opposite** of {@link mergeScopeFilters}: an empty `{}` /
+* `undefined` filter is the universe and acts as the **identity** here
+* (dropped from the `$and`, contributing NO constraint) — never the absorbing
+* "unrestricted wins". Never object-spreads the two filters (credential keys
+* could overwrite user keys and silently widen).
+*
+* @returns the conjoined filter, or `undefined` when BOTH sides are unrestricted.
+*/
+function conjoinScopeFilters(a, b) {
+	const aEmpty = !a || Object.keys(a).length === 0;
+	const bEmpty = !b || Object.keys(b).length === 0;
+	if (aEmpty && bEmpty) return void 0;
+	if (aEmpty) return b;
+	if (bEmpty) return a;
+	return { $and: [a, b] };
+}
 function canOptimizeToIn(scopes) {
 	const firstKeys = Object.keys(scopes[0]);
 	if (firstKeys.length !== 1) return false;
@@ -380,6 +402,45 @@ function unionControlsPolicy(scopes) {
 	}
 	return result;
 }
+/**
+* Conjoin two ALREADY-UNIONED controls policies (each the output of
+* {@link unionControlsPolicy} for one authority pass) under DENY-WINS
+* intersection — a control is permitted only if BOTH passes permit it. This is
+* the credential-attenuation combiner; polarity is the **opposite** of
+* {@link unionControlsPolicy} (which is additive / silence-wins).
+*
+* Per control key (absent ≡ allowed, matching {@link unionControlsPolicy}):
+*   - denied (`false`) on EITHER side → `false`.
+*   - allowed on one side → the OTHER side's gate (`allow ∧ X = X`).
+*   - whitelist ∧ whitelist → the INTERSECTION of the two arrays (only values
+*     allowed by both; may be empty = nothing permitted).
+*
+* @returns merged policy; keys absent from the result mean "allowed" (callers
+*          treat a missing key as `true`), matching {@link unionControlsPolicy}.
+*/
+function intersectControlsPolicy(a, b) {
+	const result = {};
+	const keys = new Set([...Object.keys(a), ...Object.keys(b)]);
+	for (const key of keys) {
+		const av = key in a ? a[key] : true;
+		const bv = key in b ? b[key] : true;
+		if (av === false || bv === false) {
+			result[key] = false;
+			continue;
+		}
+		if (av === true) {
+			if (Array.isArray(bv)) result[key] = [...bv];
+			continue;
+		}
+		if (bv === true) {
+			if (Array.isArray(av)) result[key] = [...av];
+			continue;
+		}
+		const bset = new Set(bv);
+		result[key] = [...new Set(av)].filter((v) => bset.has(v)).toSorted();
+	}
+	return result;
+}
 //#endregion
 //#region src/codegen/extract.ts
 function hasWildcard(s) {
@@ -452,4 +513,4 @@ function generateResourceTypes(map, options) {
 	return lines.join("\n");
 }
 //#endregion
-export { allowTableAction, allowTableRead, allowTableWrite, definePrivilege, defineRole, extractResourceActions, generateResourceTypes, getProjectionMode, isFieldAllowed, mergeScopeFilters, restrictProjection, unionControlsPolicy, unionProjections };
+export { allowTableAction, allowTableRead, allowTableWrite, conjoinScopeFilters, definePrivilege, defineRole, extractResourceActions, generateResourceTypes, getProjectionMode, intersectControlsPolicy, isFieldAllowed, mergeScopeFilters, restrictProjection, unionControlsPolicy, unionProjections };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/arbac",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "Batteries-included RBAC: builder API, privilege factories, scope merge utilities",
   "keywords": [
     "access-control",
@@ -45,7 +45,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@aooth/arbac-core": "0.1.7"
+    "@aooth/arbac-core": "0.1.8"
   },
   "scripts": {
     "build": "vp pack",